# HashiCorp: Hashicorp Linux packages GPG key rotation

- Impact (vendor’s label): major
- Status: resolved
- Started: 2026-09-10 13:24 UTC · Resolved: 2026-09-10 20:40 UTC · Duration: 7.3 h
- Updates: 5 · Affected components: RPM Repository, Linux Package Archive Site, APT Repository
- [Vendor status page: https://status.hashicorp.com/incidents/01M25QV97NFJ5AS3NQFCFRC98S](https://status.hashicorp.com/incidents/01M25QV97NFJ5AS3NQFCFRC98S)
- [Company: HashiCorp](https://rewindex.com/company/hashicorp.md)

## Summary

HashiCorp reported a major Linux package verification issue during GPG key rotation: the published fingerprint was outdated and might not match the active signing key. The incident ran from 2026-09-10 13:24 UTC to 2026-09-10 20:40 UTC (7 h 16 min). HashiCorp updated apt/rpm repository keys and documentation, worked on re-signing older-key packages, and reported resolution. _(machine-written, sol)_
## Timeline of updates

- **identified** 2026-09-10 13:24 UTC: We are currently updating documentation and package verification guidance following an ongoing GPG key rotation for all HashiCorp Linux packages. The fingerprint currently displayed on our site is outdated and may not match the active signing key. We are actively updating the published fingerprint information and related documentation. We will provide an update once the corrected fingerprint details are available.
- **identified** 2026-09-10 14:45 UTC: We have updated the keys in the apt and rpm repos and the documentation. Our engineers are working to identify and re-sign packages signed with the older key
- **identified** 2026-09-10 15:50 UTC: Our engineers have identified the issue and are working through remaining packages.
- **monitoring** 2026-09-10 16:35 UTC: Our Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.
- **resolved** 2026-09-10 20:40 UTC: Our Engineering team has resolved the issue. These systems should now be operating normally. If you continue to experience any problems, please open a ticket with our support team.

## Rewindex changes for this incident

- 2026-09-10 13:24 UTC: [Major incident: Hashicorp Linux packages GPG key rotation](https://rewindex.com/change/ief9cdbcff42b1b.md)


---
Canonical: https://rewindex.com/company/hashicorp/incidents/01M25QV97NFJ5AS3NQFCFRC98S · Markdown: https://rewindex.com/company/hashicorp/incidents/01M25QV97NFJ5AS3NQFCFRC98S.md · JSON: https://rewindex.com/api/v1/companies/hashicorp/incidents/01M25QV97NFJ5AS3NQFCFRC98S · Generated 2026-10-18T12:22:45.973Z